search

CENSUS / shadow

jemalloc heap exploitation framework
Other
447 stars 69 forks source link

I get a Python Exception with unknown error when execute jeparse -c #15

Open galelbaz opened 4 years ago

galelbaz commented 4 years ago

hey and thanks for this amazing project. Im trying to work with it and it keeps getting crashed with some unknown error from python. my phone is based on android7 64bit (and rooted of course) but when I run jeparse i get the following error exception Reading /system/bin/linker64 from remote target... 0x0000007e6a11cb6c in __epoll_pwait () from target:/system/lib64/libc.so
(gdb) source /home/galel/Desktop/android_debug/gdb_shadow_env/shadow/gdb_driver.py (gdb) jeparse -v -c /home/galel/Desktop/android_debug/gdb_shadow_env/shadow/cfg/android7_64.cfg [shadow] parsing configuration... [shadow] parsing structures from memory... [shadow] 2020-03-24 06:24:38 Python Exception <type 'exceptions.KeyError'> ('542289989448',): Error occurred in Python: ('542289989448',)

the debug.log file looks as follow - parse_general() parse_chunks() chunk @ 0x7e42a00000 chunk @ 0x7e43000000 chunk @ 0x7e43200000 chunk @ 0x7e43400000 chunk @ 0x7e43600000 chunk @ 0x7e43800000 chunk @ 0x7e43a00000 chunk @ 0x7e44000000 chunk @ 0x7e46400000 chunk @ 0x7e47e00000 chunk @ 0x7e48c00000 chunk @ 0x7e49400000 chunk @ 0x7e49c00000 chunk @ 0x7e4a600000 skipping non-page aligned chunk address 0x7e5f5cb900 chunk @ 0x7e4cc00000 chunk @ 0x7e5f400000 chunk @ 0x7e62000000 chunk @ 0x7e69a00000 parse_all_runs() parsing chunk @ 0x7e42a00000 [0000] mapelm = 0x441 small run offset = 0x0 binind = 0x22 size = 0x3000 run_hdr = 0x7e42a01018 addr = 0x7e42a0c000 [0001] mapelm = 0x2441 small run offset = 0x1000 [0002] mapelm = 0x4441 small run offset = 0x2000 [0003] mapelm = 0x441 small run offset = 0x0 binind = 0x22 size = 0x3000 run_hdr = 0x7e42a01120 addr = 0x7e42a0f000 [0004] mapelm = 0x2441 small run offset = 0x1000 [0005] mapelm = 0x4441 small run offset = 0x2000 [0006] mapelm = 0x3c1 small run offset = 0x0 binind = 0x1e size = 0x3000 run_hdr = 0x7e42a01228 addr = 0x7e42a12000 .. .. .. untill [0476] mapelm = 0x6321 small run offset = 0x3000 [0477] mapelm = 0x8321 small run offset = 0x400 when it just stops here...

Ive used the gdbserver that youve added with the source of this proj and also tested the android ndk's last version gdbserver for the client ive also used gdb from the linux86_64 prebuilt dir (complied with python 2.7.5) that works fine with everything besides the shadow plugin. (tried with gdb-multiarch and it didnt went well also...)

silasol commented 4 years ago

I've run into this problem too. I then use the android-ndk-r12b provided by Google, which contains the pre-compiled gdb 7.11. Every things is OK

(gdb) source /home/lushan/Tools/shadow/gdb_driver.py 
(gdb) jeparse -c /home/lushan/Tools/shadow/cfg/android6_32.cfg
[shadow] parsing configuration...
[shadow] parsing structures from memory...
[shadow] 2020-04-13 18:49:58
[shadow] structures parsed
[shadow] 2020-04-13 18:49:58

The gdb's path of android-ndk-r12b is

android-ndk-r12b/prebuilt/linux-x86_64/bin/gdb

I hope it helps you.

silasol commented 4 years ago

This GDB version uses python 2.7.5 

(gdb) python
>import sys
>print sys.version
>end
2.7.5 (default, Jun 15 2016, 07:02:37) 
[GCC 4.8.4]

The error may be related to the python version.